GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
ID: fa81140a-da9a-5809-ae6b-7275ccaa87c6
STIX ID: report--fa81140a-da9a-5809-ae6b-7275ccaa87c6
Feed Name: The Hacker News
GitHub announced breaking changes in npm v12 that make install-time lifecycle scripts opt-in, block execution of preinstall/install/postinstall scripts from dependencies by default, and restrict resolving Git and remote URL dependencies unless explicitly allowed; developers are advised to upgrade, review warnings, and approve trusted scripts to reduce software supply-chain risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.